security-secrets

The Opencode Configurator (agents/opencode-configurator/) is a meta-configuration system that makes setting up OpenCode effortless. Just ask naturally:

• "Is there a plugin for reducing token usage?"
• "Set up permissions so destructive commands require approval"
• "Create a /review command that analyzes code without making changes"
• "I want to build a skill for working with our internal API"
• "Find an MCP server for filesystem access"

The configurator agent draws on seven specialized skills:

| Skill | What it does |

|-------|--------------|

| plugin-installer | Find and install community plugins, maintain a local catalog |

| opencode-config | Edit opencode.json with guided setup for models, permissions, providers |

| command-creator | Build custom /slash commands through interactive Q&A |

| skill-creator | Scaffold new skills with proper structure, scripts, and references |

| agent-architect | Design agents with research-backed prompt engineering patterns |

| mcp-installer | Find, install, and configure Model Context Protocol (MCP) servers |

| model-researcher | Research and configure new/custom AI models not yet in models.dev, with verified specifications |

Installation: Drop the skill/ and agent/ folders into ~/.config/opencode/.

See agents/opencode-configurator/README.md for full details.

---

The Ralph Wiggum Loop (/loop) is a high-intensity, autonomous "black box" orchestrator that follows the KISS (Keep It Simple, Stupid) principle: The technique is deterministically bad in an undeterministic world.

It puts a specialized task tool subagent in an evolving while-loop, pushing it through repeated layers of implementation and hyper-detailed verification until the task is 100% complete.

See commands/.opencode/command/loop.md for full details.

---

The Create OpenCode Plugin (agents/create-opencode-plugin/) is a workflow bundle for AI-assisted plugin development in OpenCode. Describe what you want your plugin to do, and the workflow guides you through design, testing, and publishing.

Usage: Run /create-plugin [your idea].

See agents/create-opencode-plugin/README.md for full details.

---

• Gemini/GLM Focused Mode (plugins/gemini-glm-focused-mode/) – Injects a rigorous system prompt for GLM-4.7 and Gemini models to enforce precise, grounded, and persistent coding behavior.

---

The Security Reviewer (agents/security-reviewer/) is a specialized agent for auditing codebases against vibecoding vulnerabilities. It bundles 10 framework-specific security skills.

See agents/security-reviewer/README.md for full details.

---

• Thinking Levels Variants (thinking-variants config/thinking-levels-opencode.json) – OpenCode configuration with model variants for Ctrl+T thinking level switching.

---

Agent Catalog

To optimize model usage, we recommend disabling the legacy generic general subagent in your opencode.json and using the fast/smart split instead:

```json

"subagents": {

"general": {

"disable": true

}

}

```

Agents are organized under agents/:

- generic/ – Reusable global agents that belong in ~/.config/opencode/agent/:

- fast – High-speed workhorse for trivial edits and file lookups.

- smart – Senior developer for complex bug hunting and refactoring.

- subagent-orchestrator – Dispatches specialists and enforces scope isolation.

- openspec-orchestrator – Enforces strict OpenSpec formatting/validatio